0f7ed0eeafeb6aaf8283499123a1fb71_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f7ed0eeafeb6aaf8283499123a1fb71_JaffaCakes118
Size

68KB
MD5

0f7ed0eeafeb6aaf8283499123a1fb71
SHA1

1fb9df78bf82af8a4c666c3e09930dc4d9ec24e1
SHA256

de109310485c76a7d04672d55ebb168c98f7e67138507c77b35ff414a3a8b06a
SHA512

1c8bfda6d448e422e115510c2b3730d46c45b4425ce028f471f444f95573d8cf77628fb24f7ea66bc0b32202816fc4e09be13a3ebba5a63851f655ac3ed93f3d
SSDEEP

1536:v5+bI2RsF4zYGh/jCMsJiVjO8+LA3f8rxISEig90Oe:v5+KoCtJiVjO8+0v8rxdc9Le

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f7ed0eeafeb6aaf8283499123a1fb71_JaffaCakes118

Files

0f7ed0eeafeb6aaf8283499123a1fb71_JaffaCakes118
.dll windows:5 windows x86 arch:x86

1c2f1ea50b157107a28126db81c7b937

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Information\Desktop\Windows\OS_Starter.exe

Imports

shlwapi

PathFileExistsA

kernel32

SetTimerQueueTimer
CopyFileW
GetCommProperties
IsDBCSLeadByteEx
VirtualProtect
FormatMessageA
FindResourceExA
CreateSemaphoreA

user32

IsCharAlphaW
PostMessageA
OemToCharBuffA
PeekMessageA
LookupIconIdFromDirectory
DestroyIcon
CreateDialogParamW
SendMessageW

msvcrt

_cexit
_exit
__p__fmode
fputs
__setusermatherr
iswctype
_XcptFilter
__p__commode
fgetc
__set_app_type
_controlfp
_initterm
wcstol
_ismbblead
exit
strstr
_amsg_exit
__getmainargs
calloc

Exports

Exports

_ReplyMessageReplyMessageReplyMessage@0

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ